How do you guarantee the server that sent the Javascript to the browser, which stores the client secret key in the browser, didn't get hacked to also send the client secret key somewhere else after it was generated in the client?
We'd also love to bind our client JS code to a hash of our build output from GitHub, but as of now there's no simple way to do this that the browser will pin automatically - integrity checks are good, but don't prevent the server from just changing the hash. We've toyed with writing an extension for this, but haven't gotten around to it.
UPD yeah, extension hashing resources sounds nice too
Usually, when I have an idea for a standard, it turns out one exists, so maybe I’ll do some digging…
Or do a git clone (pinned to commit hash) and host the client locally, I guess))